Minimize The Admission Of Containers Sharing The Host Process ID Namespace

# 1) Create a baseline restrictive PodSecurityPolicy (if your cluster still uses PSP)
#    This denies hostPID by default.
#    Run on: any machine with kubectl access.

cat <<'EOF' > psp-deny-hostpid.yaml
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: deny-hostpid
spec:
  privileged: false
  hostPID: false
  hostIPC: false
  hostNetwork: false
  seLinux:
    rule: RunAsAny
  runAsUser:
    rule: RunAsAny
  fsGroup:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  volumes:
  - '*'
EOF

kubectl apply -f psp-deny-hostpid.yaml

# 2) Bind this PSP to a namespace with user workloads (example: "production").
#    Replace "production" with each target namespace.
#    Run on: any machine with kubectl access.

NAMESPACE=production

cat <<EOF | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: use-deny-hostpid-psp
  namespace: ${NAMESPACE}
rules:
- apiGroups: ['policy']
  resources: ['podsecuritypolicies']
  verbs:     ['use']
  resourceNames: ['deny-hostpid']
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: use-deny-hostpid-psp
  namespace: ${NAMESPACE}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: use-deny-hostpid-psp
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:serviceaccounts:${NAMESPACE}
EOF

# 3) (Alternative / additional) Use Pod Security Admission via labels to restrict hostPID.
#    Use "restricted" or stricter for all user namespaces (example: "production").
#    Run on: any machine with kubectl access.

kubectl label namespace production \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/enforce-version=latest \
  --overwrite

# 4) (Optional) Example: secure Pod manifest WITHOUT hostPID for user workloads.
#    Ensure all application manifests in user namespaces omit hostPID or set it to false.

cat <<'EOF' > example-app-pod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: example-app
  namespace: production
spec:
  hostPID: false
  containers:
  - name: app
    image: nginx:stable
EOF

kubectl apply -f example-app-pod.yaml

# 5) Verification: list all Pods with hostPID=true to confirm none exist in user namespaces.
#    Run on: any machine with kubectl access.

kubectl get pods --all-namespaces -o json \
  | jq -r '.items[]
           | select(.spec.hostPID == true)
           | "\(.metadata.namespace) \(.metadata.name) hostPID=true"' || true

#!/usr/bin/env bash
set -euo pipefail

# This script:
# - Creates a Pod Security Policy–style restriction using Pod Security Admission (PSA) via labels/Policy/PSP replacement
# - For each namespace with user workloads, it:
#   * Labels the namespace with a restricted Pod Security level (baseline or restricted)
#   * Creates/patches a validating admission policy (if supported) or a validating webhook
#
# NOTE:
# - This is a MANUAL benchmark control: different clusters use different admission stacks.
# - This script implements a conservative, Kubernetes-native control using Pod Security Admission labels
#   and a validating admission policy if available. Review carefully before using in production.

# -------- CONFIGURATION --------

# Namespaces to ignore (system and infrastructure)
EXCLUDED_NAMESPACES=(
  "kube-system"
  "kube-public"
  "kube-node-lease"
  "local-path-storage"
  "default"          # remove this if you run user workloads in 'default'
)

# Pod Security level to enforce; choose "baseline" or "restricted"
POD_SECURITY_LEVEL="baseline"

# Label key for Pod Security Admission
POD_SECURITY_ENFORCE_LABEL="pod-security.kubernetes.io/enforce"

# ValidatingAdmissionPolicy name (for clusters >=1.26 supporting it)
VAP_NAME="deny-hostpid-pods"
VAP_BINDING_NAME="deny-hostpid-pods-binding"

# -------- FUNCTIONS --------

is_excluded_ns() {
  local ns="$1"
  for e in "${EXCLUDED_NAMESPACES[@]}"; do
    if [[ "$ns" == "$e" ]]; then
      return 0
    fi
  done
  return 1
}

kubectl_safe() {
  kubectl "$@" 2>/dev/null
}

# -------- PRECHECKS --------

echo "Checking kubectl access..."
kubectl version --short >/dev/null

echo "Determining cluster support for ValidatingAdmissionPolicy..."
if kubectl_safe api-resources | grep -q "^validatingadmissionpolicies"; then
  HAS_VAP="true"
else
  HAS_VAP="false"
fi
echo "ValidatingAdmissionPolicy supported: ${HAS_VAP}"

# -------- STEP 1: Label namespaces with Pod Security Admission --------
# Run on: any machine with kubectl access

echo "Labeling namespaces with Pod Security Admission level: ${POD_SECURITY_LEVEL}"

ALL_NAMESPACES=$(kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}')

while read -r NS; do
  [[ -z "$NS" ]] && continue
  if is_excluded_ns "$NS"; then
    echo "Skipping excluded namespace: ${NS}"
    continue
  fi

  # Skip namespaces without user pods
  POD_COUNT=$(kubectl get pods -n "$NS" --no-headers 2>/dev/null | wc -l | tr -d ' ')
  if [[ "$POD_COUNT" -eq 0 ]]; then
    echo "Skipping namespace with no pods: ${NS}"
    continue
  fi

  CURRENT_LABEL=$(kubectl get ns "$NS" -o jsonpath="{.metadata.labels.${POD_SECURITY_ENFORCE_LABEL}}" 2>/dev/null || echo "")

  if [[ "$CURRENT_LABEL" == "${POD_SECURITY_LEVEL}" ]]; then
    echo "Namespace ${NS} already labeled ${POD_SECURITY_ENFORCE_LABEL}=${POD_SECURITY_LEVEL}"
  else
    echo "Labeling namespace ${NS} with ${POD_SECURITY_ENFORCE_LABEL}=${POD_SECURITY_LEVEL}"
    kubectl label ns "$NS" "${POD_SECURITY_ENFORCE_LABEL}=${POD_SECURITY_LEVEL}" --overwrite
  fi
done <<< "${ALL_NAMESPACES}"

# -------- STEP 2: Create/Update ValidatingAdmissionPolicy (if supported) --------
# Run on: any machine with kubectl access

if [[ "${HAS_VAP}" == "true" ]]; then
  echo "Applying ValidatingAdmissionPolicy to deny hostPID pods..."

  cat <<'EOF' | kubectl apply -f -
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: deny-hostpid-pods
spec:
  matchConstraints:
    resourceRules:
      - apiGroups: [""]
        apiVersions: ["v1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["pods"]
  validations:
    - expression: "!(has(object.spec.hostPID) && object.spec.hostPID == true)"
      message: "Creating pods with hostPID=true is not allowed by policy"
      reason: "Forbidden"
EOF

  cat <<EOF | kubectl apply -f -
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: ${VAP_BINDING_NAME}
spec:
  policyName: ${VAP_NAME}
  matchResources:
    namespaceSelector: {}
  validationActions: ["Deny"]
EOF

else
  echo "Cluster does not support ValidatingAdmissionPolicy;"
  echo "you must manually implement an alternative admission control (e.g. Gatekeeper/PSP replacement)."
fi

# -------- STEP 3: Verification --------
# Run on: any machine with kubectl access

echo
echo "Verifying that existing pods do not use hostPID=true..."

NONCOMPLIANT=false
kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | \
while read -r pod_name pod_namespace; do
  pod_hostpid=$(kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o jsonpath='{.spec.hostPID}' 2>/dev/null || true)
  if [[ -n "${pod_hostpid}" && "${pod_hostpid}" == "true" ]]; then
    echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostpid: ${pod_hostpid} is_compliant: false"
    NONCOMPLIANT=true
  fi
done

if [[ "${NONCOMPLIANT}" == "false" ]]; then
  echo "All existing pods are compliant (hostPID not set or false)."
else
  echo "Some existing pods are non-compliant; they must be manually reviewed and recreated without hostPID=true."
fi

echo
echo "To test enforcement, try creating a pod with spec.hostPID=true in a labeled user namespace; it should be denied."